Skip to main content

📝 AWS VPC Network ACL is unused 🟢

  • Contextual name: 📝 Network ACL is unused 🟢
  • ID: /ce/ca/aws/vpc/network-acl-unused
  • Located in: 📁 AWS VPC

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • RELIABILITY

Similar Policies​

Logic​

Description​

Open File

Description​

Ensure that all non-default AWS VPC Network ACLs are actively associated with at least one subnet. Unused NACLs should be identified and removed to maintain a secure and well-managed network environment.

Rationale​

Network ACLs that are not associated with any subnets are considered unused. While unused NACLs do not incur direct costs, they present a potential security risk. If such a NACL contains overly permissive or misconfigured rules and is later associated with a subnet, it could unintentionally expose resources to unauthorized traffic. Regularly identifying and removing unused NACLs reduces the potential attack surface and streamlines network management.

Impact​

Removing unused NACLs has no operational impact on existing resources. However, it strengthens the overall security posture and simplifies audits by eliminating unnecessary configurations.

Audit​

This policy flags an AWS VPC Network ACL as INCOMPLIANT if it has no related AWS VPC Network ACL Associations.

Remediation​

Open File

Remediation​

From Command Line​

Delete Unused NACLs​
aws ec2 delete-network-acl \
    --network-acl-id {{network-acl-id}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.16] Unused Network Access Control Lists should be removed1
💼 Cloudaware Framework → 💼 System Configuration33
💼 FedRAMP High Security Controls → 💼 CM-8(1) Updates During Installation and Removal (M)(H)1
💼 FedRAMP Moderate Security Controls → 💼 CM-8(1) Updates During Installation and Removal (M)(H)1
💼 NIST SP 800-53 Revision 5 → 💼 CM-8(1) System Component Inventory _ Updates During Installation and Removal1
💼 PCI DSS v3.2.1 → 💼 1.1.7 Requirement to review firewall and router rule sets at least every six months.9
💼 PCI DSS v4.0.1 → 💼 1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.9
💼 PCI DSS v4.0 → 💼 1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.9